Extension of the EU-UK Adequacy Decisions: what’s next?

On 28 June 2021, the European Commission adopted two adequacy decisions in favour of the United Kingdom (the “UK”) (collectively, the “Adequacy Decisions”): one under the General Data Protection Regulation 2016/679 (the “GDPR”) for data transfers from the European Union (the “EU”) to the UK, and one under the Law Enforcement Directive¹ (“LED”) for law enforcement-related transfers.

These decisions recognised that, at that time, the UK’s data protection framework ensured an “essentially equivalent” level of data protection as that guaranteed within the EU. However, the Adequacy Decisions were subject to a four-year sunset period, originally set to expire on 27 June 2025.

In light of ongoing data protection reforms in the UK and in order to allow for a thorough assessment of whether the evolving UK regime continues to meet EU standards, the validity of the Adequacy Decisions has been, in the interim, technically extended until 27 December 2025.

At present, data transfers from the EU to the UK remain lawful without the need for additional safeguards. Nevertheless, the European Commission retains the right to amend, suspend or revoke the Adequacy Decisions should it determine that the UK no longer provides an equivalent level of protection. 

On 22 July 2025, the European Commission initiated the process for the adoption of two decisions regarding the renewal of the Adequacy Decisions. If approved, the decisions will apply for a period of six years as of their entry into force. On 20 October 2025, as part of the adoption process, the European Data Protection Board adopted two opinions supporting the European Commission’s draft decisions to renew the Adequacy Decisions for the UK under the GDPR and the LED, respectively.

EU controllers and processors should remain vigilant and closely monitor legislative developments while awaiting the European Commission’s final determination on this matter.